Zero › Module 4 › Lesson 2
Managed vs BYOD
MDM and EDR named literacy — Intune, Jamf, Defender, CrowdStrike concepts — tool role card on YOUR $ZT_LAB devices folder.
Visual · t40_mdm_edr
MDM + EDR named. $ZT_LAB. Original Cyberlium.
Opening
MDM enforces posture — EDR proves runtime health — name both roles on LAB-ZT-001 device architecture stub.
MDM/UEM (Intune, Jamf, Workspace ONE literacy): enroll devices, deploy configs, compliance policies, app protection. EDR/XDR (Defender, CrowdStrike, SentinelOne literacy): telemetry, threat detection, isolation — feeds trust score. Write tool role card: what MDM owns vs what EDR owns vs overlap — fictional vendor names OK. No agent tampering labs. Next: Compliance Hygiene.
1. MDM responsibilities (named)
Enrollment, configuration profiles, OS update rings, compliance policy, remote wipe literacy, app deployment.
Source of truth for device compliance signal to IdP.
Command guide
Try these commands — MDM responsibilities (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
CISA ZTMM Devices — https://www.cisa.gov/zero-trust-maturity-model NIST SP 800-207 — https://csrc.nist.gov/publications/detail/sp/800-207/final
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export ZT_LAB=${ZT_LAB:-$HOME/cyberlium-lab/t40-zt}
export ZT_DEVICES=${ZT_DEVICES:-$ZT_LAB/LAB-ZT-001/devices}
cat > "$ZT_DEVICES/mdm-edr-role-card.md" <<'EOF'
# MDM + EDR Role Card — LAB-ZT-001 (literacy)
## MDM/UEM owns
- Enrollment, config profiles, compliance policy, patch rings, remote wipe literacy
## EDR/XDR owns
- Runtime telemetry, behavioral detection, containment, forensic timeline literacy
## Integration
Device → MDM compliance signal + EDR health → IdP CA → App access
Refused: EDR disable/tampering tutorials
LAB SAMPLE — NOT FOR PRODUCTION ARCHITECTURE CLAIMS
EOFCommand — copy this
grep -E 'MDM|EDR|Refused|LAB SAMPLE' "$ZT_DEVICES/mdm-edr-role-card.md"
python3 -c "print('MDM sets baseline; EDR catches runtime drift')"Primary tools to practice this lesson: grep, python3. Reference sites: CISA ZTMM Devices (https://www.cisa.gov/zero-trust-maturity-model); NIST SP 800-207 (https://csrc.nist.gov/publications/detail/sp/800-207/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. EDR responsibilities (named)
Process telemetry, behavioral detection, containment, forensic timeline literacy. Feeds risk score to conditional access in advanced maturity.
EDR unhealthy → downgrade trust or block — design row on matrix.
3. Integration diagram
Device → MDM compliance + EDR health → IdP CA → App. Label data flow on stub.
Ship: MDM/EDR role card + mini diagram. Next: Compliance Hygiene.
4. What you ship: MDM/EDR role card
MDM vs EDR responsibilities + integration diagram stub. Fictional vendors. chmod 600.
5. What you record before the next lesson
Date. MDM/EDR card. $ZT_LAB named. File t40-m04-l02-mdm-edr-named.txt chmod 600.
6. Wrong vs right: bypass cookbooks vs YOUR ZT design
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Teach EDR disable steps as ZT lab. Conflate MDM and IdP as same product.
Right
Write MDM/EDR role card with integration diagram. Next: Compliance Hygiene.
Mission: MDM/EDR role card
1) List five MDM responsibilities. 2) List five EDR responsibilities. 3) Draw compliance signal flow to IdP. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
MDM sets baseline; EDR catches runtime drift — both feed posture.
Knowledge Check
APPLY: MDM primarily provides:
Multiple choice
Knowledge Check
APPLY: True or False: EDR unhealthy signal can affect access decisions.
True or False
Knowledge Check
APPLY: EDR disable tutorials in ZT lab:
Multiple choice